Privacy Policy
Last updated: 19 October 2026
Your privacy matters to us. This policy explains how I collect, use and look after your personal information when you visit my website, contact me, book an appointment or receive a treatment.
Who Is Responsible for Your Information?
I am Isabella Lowe, a sole trader trading as Isabella Lowe. I am the data controller, which means I am responsible for deciding how and why your personal information is used.
You can contact me about your information or this policy at:
Email: info@isabellalowe.co.uk
Address: Clock Barn 2, Little Baldon, Oxford, OX44 9PU
The Information I Collect
Depending on your enquiry, booking and treatment, I may collect:
Personal and contact details: your name, email address, telephone number, postal address, date of birth and any gender information you choose to provide.
Booking and treatment records: appointment details, treatment history, areas being treated, consultation answers, patch-test results, consent records, dates and signatures.
Health and treatment-suitability information: relevant medical conditions, medication, allergies, pregnancy or breastfeeding, skin and eye conditions, previous reactions, surgery and recent treatments.
Relevant lifestyle information: occupation, skincare products, sun exposure and other information needed to assess your suitability for a particular treatment.
Emergency contact details: the name and telephone number of someone you nominate.
Photographs: images taken for your treatment record and any images you separately agree may be used publicly.
Payment and communication records: transaction details, correspondence and your marketing preferences.
Website information: information such as your IP address, browser and device details, pages visited and interactions with the website.
Most information comes directly from you through bookings, consultation forms, conversations or correspondence. Payment information may also come from Stripe, and website usage information from Squarespace.
If you are an emergency contact, your details are provided by the client who nominates you. Clients should let their nominated contact know and share this policy with them.
Why I Use Your Information
I use your information for the following purposes:
Managing bookings and providing treatments
I use the information needed to arrange appointments, communicate with you about your booking and provide the services you request. The lawful basis is performing our contract, or taking steps you request before entering into that contract.
Assessing treatment suitability and maintaining treatment records
Relevant consultation information helps me assess suitability, plan your treatment and record the treatment provided. Where this includes health information, I also ask for your explicit consent to collect, store and use it for these purposes.
Running the studio and handling enquiries
I use relevant information to respond to enquiries, maintain security, keep emergency contact details and manage complaints. This is based on my legitimate interests in running the studio responsibly and supporting clients, balanced against your rights.
Keeping required financial records
I retain the records needed to meet tax and accounting requirements. The lawful basis is complying with my legal obligations.
Establishing or defending legal claims
I may retain or share relevant treatment records where necessary to establish, exercise or defend legal claims. This is based on my legitimate interests in protecting my legal position and, where health information is involved, the legal-claims condition for processing that information. Records kept for this purpose are limited to what is relevant and proportionate.
Marketing and public photographs
I rely on your consent for promotional messages and for publishing photographs you have agreed may be used publicly.
Your Health Information
Health information receives additional protection under data protection law.
I ask only for information relevant to assessing suitability, providing treatment and maintaining an appropriate record. Please let me know if relevant information changes between appointments.
You can withdraw your consent to the use of your health information by contacting me. If information is necessary to assess suitability or provide treatment safely, withdrawing consent or choosing not to provide it may mean I cannot provide or continue that treatment.
Withdrawal does not affect processing that was lawful before you withdrew consent. It also does not automatically require the deletion of relevant records that must still be retained on an independently justified legal basis, such as records necessary for legal claims. I will explain this if it applies.
Marketing Messages
You can choose to receive promotional messages when booking or when another sign-up option is offered.
I send marketing only where you have opted in to the relevant type of communication. Choosing not to receive marketing will not affect your ability to book treatments.
You can opt out at any time by contacting Bella, emailing info@isabellalowe.co.uk, or following the opt-out instructions in a promotional message.
Booking confirmations, appointment reminders and necessary treatment communications are separate from marketing messages.
Photographs
Photographs may be taken to document the treatment area, treatment progress or results as part of your treatment record.
Permission to keep treatment photographs is separate from permission to publish them.
I will only use identifiable photographs on my website, social media or other promotional materials where you have separately agreed to that use. This permission is optional.
You can withdraw permission for public use by contacting me. I will stop further promotional use and remove the relevant images from online content under my control. Any need to retain a photograph privately as part of your treatment record will be assessed separately under the retention and legal grounds explained in this policy.
Who Handles Your Information?
I use the following service providers:
Timely: to manage bookings and store client contact details, consultation information and treatment-related records.
Stripe: to process payments and provide associated transaction information. Stripe also processes certain information for its own purposes, including fraud prevention and meeting legal requirements.
Squarespace: to host the website and provide website analytics and related functionality.
Email and communications providers: where needed to handle enquiries and communicate about appointments.
Relevant information may also be shared with professional advisers, insurers or public authorities where necessary and lawful.
I limit the information shared to what is needed for the relevant purpose.
You can read more about the main providers here:
Timely Privacy Policy
Stripe Privacy Policy
Squarespace Privacy Information
Information Processed Outside the UK
Some service providers process personal information outside the UK.
Timely states that it hosts data in the United States and Australia. Squarespace and Stripe also operate internationally.
Squarespace and Stripe describe their use of the UK Extension to the EU–US Data Privacy Framework and approved contractual safeguards, where applicable, in their published transfer terms:
Squarespace Data Processing Addendum
Stripe Data Transfers Addendum
You can contact me for further information about the international processing of your information.
Website Cookies and Analytics
The website uses Squarespace functionality and analytics to operate the site and understand how visitors use it.
Essential cookies support necessary website functions. Optional analytics help identify which pages are visited and how the website can be improved.
Where consent is required, optional cookies and similar tracking technologies will only be used after you agree. You can manage your choices through the website’s cookie controls and your browser settings.
How Long I Keep Your Information
I keep personal information for the period needed for its stated purpose, taking account of relevant legal requirements.
Treatment and consultation records
Retention is assessed from your last treatment, taking account of the treatment provided, continuity of treatment, relevant legal-claim time limits, applicable insurance conditions and any unresolved complaint or claim. Relevant records may need to remain after you stop attending the studio. I review the information held and remove information that is no longer needed.
Tax and accounting records
As a sole trader, I normally keep the records required for Self Assessment for at least five years after the relevant 31 January tax-return submission deadline. Some records may need to be kept longer where another applicable requirement or an ongoing enquiry requires this.
Enquiries
Enquiries that do not lead to a booking are kept for the time needed to respond and complete any necessary follow-up, then reviewed for deletion.
Marketing records
Marketing information is reviewed for continued relevance and used only while valid permission remains. A limited record of an opt-out may be retained to make sure you are not contacted again accidentally.
Public photographs
Images are used for the purposes you agreed to while that permission remains, with their continued use reviewed periodically.
When information is no longer needed, it is securely deleted or anonymised.
Keeping Your Information Secure
I take appropriate steps to protect your information against unauthorised access, loss or misuse.
Access is limited to the people and service providers who need it for the purposes described in this policy.
Your Rights
Depending on the circumstances, you have the right to:
Ask for access to your personal information.
Ask for inaccurate or incomplete information to be corrected.
Ask for information to be deleted.
Ask for the use of your information to be restricted.
Object to processing based on legitimate interests.
Receive certain information in a portable format.
Withdraw consent where processing relies on it.
You can object to direct marketing at any time.
Some rights depend on the circumstances and the legal grounds for using the information. For example, certain records may need to remain where there is a justified legal requirement or a need to establish or defend legal claims.
To make a request, email info@isabellalowe.co.uk. I may need to check your identity before providing personal information.
Questions or Complaints
If you have a concern about your information, please contact me at info@isabellalowe.co.uk.
I will acknowledge a data protection complaint within 30 days, investigate without undue delay and explain the outcome.
You also have the right to complain to the Information Commissioner’s Office:
Changes to This Policy
I may update this policy to reflect changes to the studio, the services used or applicable requirements. The latest version and its update date will be available on this page.